web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
References
Configurations
History
20 Oct 2025, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Web3js web3-core-method
Web3js |
|
| References | () https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-method%401.10.4/index.js - Broken Link | |
| References | () https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57329 - Third Party Advisory | |
| CPE | cpe:2.3:a:web3js:web3-core-method:*:*:*:*:*:node.js:*:* |
26 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1321 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
24 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-24 20:15
Updated : 2025-10-20 16:30
NVD link : CVE-2025-57329
Mitre link : CVE-2025-57329
CVE.ORG link : CVE-2025-57329
JSON object : View
Products Affected
web3js
- web3-core-method
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')